Penetration Testing
Vulnerability Scanning Services and Vulnerability Assessments
Vulnerability scanning services find known weaknesses across your internal and external systems on a regular schedule, so nothing drifts unnoticed between penetration tests. We run the scans, remove false positives, prioritise what is left and rescan after fixes. As a PCI SSC-approved QSA company, we align scan cycles with PCI DSS 11.3 and ISO 27001 A.8.8.
Prefer to talk? Call +44 161 523 5276
- Internal and external scanning
- Results triaged, not just dumped
- Rescans after remediation
Trusted by banks, payment providers and global brands
On this page
- Managed vulnerability scanning as a service, for continuous coverage
- Network, cloud and web application vulnerability scanning
- Which type of vulnerability scan do you need?
- How much do vulnerability scanning services cost?
- How does a managed vulnerability scanning service run?
- Why choose Sovereign Secure for vulnerability scanning?
- Frequently asked questions
Overview
What are vulnerability scanning and assessment services?
The short answer
Vulnerability scanning is an automated, scheduled check of your systems for known weaknesses such as missing patches, outdated software and exposed services. A managed service covers internal, external, cloud and web application scans, removes false positives, ranks the rest by risk and rescans after fixes, with PCI ASV scans delivered through our PCI SSC Approved Scanning Vendor partner.
A vulnerability scan is an automated check of your systems against known weaknesses, such as missing patches, outdated software, weak encryption and exposed services. Run on a schedule, it is the broad-coverage complement to periodic penetration testing. Our guide to what a vulnerability scan is explains how scanning works, the types of scan and how long one takes.
Our vulnerability assessment services add an analyst to the scan: we confirm what matters in your environment and rank it by risk, as a one-off baseline or a managed monthly or quarterly programme. For the full process behind a vulnerability assessment, from asset discovery to risk rating, see our guide.
For PCI DSS, Requirement 11.3.1 calls for internal scans at least every three months and 11.3.2 for external scans by a PCI SSC Approved Scanning Vendor. Sovereign Secure is a QSA company rather than an ASV: we deliver PCI ASV scans through an approved partner and manage the process, the false positives and the rescans for you.
Where scans reveal issues that need a human to confirm exploitability, a penetration test is the right next step: external penetration testing for internet-facing systems, or internal penetration testing for the wider network. Scanning finds the known; testing proves the impact.
What's included
Managed vulnerability scanning as a service, for continuous coverage
A scanning programme can cover internal systems, external systems, cloud environments and PCI DSS scanning requirements, so coverage carries on between penetration tests.
- 01
External network scans
Regular scanning of your internet-facing systems for known vulnerabilities and exposure.
- 02
Internal network scans
Scanning of internal systems to find weaknesses inside the network perimeter.
- 03
Quarterly PCI ASV scans
External scans on the PCI DSS quarterly cycle, delivered through a PCI SSC Approved Scanning Vendor.
- 04
False positive management
We work through the results to remove noise, so you act on real issues rather than raw output.
- 05
Remediation guidance
Prioritised advice on what to fix first, and support in reaching a passing ASV scan.
- 06
Scheduling and management
We run scans on schedule and manage the process so nothing is missed.
- 07
Trend reporting
Reporting that shows how your exposure changes over time, not just a point-in-time list.
- 08
Rescan support
Rescans after remediation to confirm issues are resolved and, for PCI, to achieve a passing result.
What we test for
Network, cloud and web application vulnerability scanning
Scanning covers internal and external networks, cloud environments, web applications and the PCI DSS 11.3 cycle. Every result is triaged before it reaches you and ranked using CVSS and EPSS scores alongside what each system does for your business. Scans cover the assets you list; external attack surface management finds the ones nobody listed. Scanning is part of the discovery stage of continuous threat exposure management, and breach and attack simulation can then check that your controls would block or detect attacks on what remains. Need a manual penetration test alongside the scans? Our VAPT page explains how the two run as one engagement.
Network vulnerability scanning (internal and external)
Known weaknesses on your internet-facing systems and across internal hosts and infrastructure.
- Exposed services and open ports
- Known CVEs on public-facing and internal hosts
- Missing operating-system and software patches
- Weak or outdated TLS configurations
- Exposed management interfaces
- End-of-life and unsupported software
- Default and weak credentials
- Insecure service configurations
Cloud vulnerability scanning
Misconfigurations and known weaknesses in AWS, Azure and Google Cloud workloads.
- Publicly accessible storage buckets and blobs
- Over-permissive security groups and firewall rules
- Known CVEs on cloud-hosted virtual machines
- Exposed cloud management interfaces and endpoints
- Configuration checks against CIS Benchmarks
PCI DSS 11.3 scanning
Internal and external scanning on the cycle PCI DSS Requirement 11.3 sets.
- Quarterly internal scans (11.3.1)
- Authenticated internal scanning (11.3.1.2)
- Quarterly external ASV scans via an approved partner (11.3.2)
- Rescans after significant change
- Scan reports ready for your QSA
Web application vulnerability scanning
Automated coverage of common web-facing weaknesses.
- Common web vulnerabilities
- Outdated web components and frameworks
- Insecure headers and configuration
- Exposed administrative pages
- Known issues in web platforms
Reporting and trends
Turning scan output into something you can act on.
- Prioritised, de-duplicated findings
- False positives removed
- Trend analysis over time
- Remediation tracking
- Reports suitable for auditors
Which type of vulnerability scan do you need?
Most organisations need more than one type of scan, because each one sees a different part of the estate. The table shows what each scan finds, how often it is usually run and where PCI DSS, Cyber Essentials Plus or ISO 27001 ask for it.
| Scan type | What it finds | Typical frequency | Where standards ask for it |
|---|---|---|---|
| External network scan | Internet-facing hosts and services: open ports, known CVEs, weak TLS and exposed admin interfaces | Monthly or quarterly, and after changes to the perimeter | PCI DSS 11.3.2 (quarterly ASV scans, through our partner); the external scan in Cyber Essentials Plus |
| Internal network scan | Hosts inside the network: missing patches, unsupported software, weak services and default credentials | Monthly or quarterly | PCI DSS 11.3.1 (at least every three months) |
| Authenticated scan | Logs in to each host to read installed software and settings, so it finds far more than a scan from the outside | With each internal scan | PCI DSS 11.3.1.2 for internal scans; the authenticated device checks in Cyber Essentials Plus |
| Cloud scan | Public storage, over-permissive security groups and identities, and known CVEs on cloud workloads | Monthly, or continuously for fast-changing estates | ISO 27001 A.8.8 and your side of the cloud shared responsibility model |
| Web application scan | Common web weaknesses, outdated components and insecure headers | Monthly, and after each major release | ISO 27001 A.8.8; a complement to, not a substitute for, a web application penetration test |
PCI DSS Requirement 11.3 sets the minimum for card data environments: internal and external scans at least every three months and after significant change. For the full PCI picture, see our ASV scanning page.
How much do vulnerability scanning services cost?
Scanning usually costs less than manual testing because most of the work is automated, but the analyst time spent triaging results still counts. The price depends on these drivers:
| Cost driver | Why it changes the price |
|---|---|
| IP addresses and hosts | More assets mean more scan time and more results to triage |
| Internal, external or both | Internal scanning needs access inside your network, on top of external coverage |
| Frequency | Monthly, quarterly or more frequent cycles change how many scans are run and reviewed |
| Authenticated scanning | Scans that log in to each host find more, and PCI DSS 11.3.1.2 requires them for internal scans, but they need credentials and more triage |
| Cloud accounts and web applications | Each cloud account and web application adds its own scan profile |
| PCI ASV scans | Quarterly external ASV scans, delivered through our PCI SSC Approved Scanning Vendor partner, plus any rescans needed to pass |
Our penetration testing cost guide compares scan and pen test costs, and our quote form covers scanning too.
How it works
How does a managed vulnerability scanning service run?
- 1
Scoping
We agree the systems and addresses in scope, the scan frequency, and whether PCI ASV scanning is required, then fix the price.
- 2
Setup
We configure scanning for your environment and, for PCI, register the in-scope external addresses with the approved scanning vendor.
- 3
Scanning
We run scans on the agreed schedule across internal and external systems.
- 4
Triage and reporting
We remove false positives, prioritise the findings and report them clearly with remediation advice.
- 5
Remediation support
We guide your team through fixing the issues and, for PCI, towards a passing ASV scan.
- 6
Rescan
We rescan after remediation to confirm resolution and, for PCI, to achieve the required passing result.
Scanning covers the first two of the five stages of penetration testing (planning and reconnaissance, and scanning) before the results are triaged and reported; a penetration test adds gaining access and maintaining access before its analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for vulnerability scanning?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- ASV scans delivered through a PCI SSC Approved Scanning Vendor, managed end to end by a QSA company.
- Results triaged and prioritised, so your team acts on real issues rather than raw scanner output.
- Scanning and penetration testing from one provider, so the two work together.
- Documentation ready for your PCI DSS assessment.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
What is the difference between a vulnerability scan and a penetration test?
A scan is automated and repeatable, giving broad coverage of known weaknesses on a schedule. A penetration test is manual and goes deeper, proving which weaknesses are genuinely exploitable and chaining them the way an attacker would. Most organisations need both: scanning for continuous coverage and testing for depth.
Is vulnerability scanning the same as VAPT?
No. Scanning is the vulnerability assessment half: broad automated checks on a schedule. VAPT adds a manual penetration test that proves what is exploitable; our VAPT services page explains what the combined engagement includes.
What is managed vulnerability scanning?
Managed vulnerability scanning means we run the scans for you on an agreed schedule, triage the results, track remediation and rescan, so you receive a short list of real issues rather than a raw scanner export. It suits teams without the time to run and interpret scanning tools themselves.
Are you an Approved Scanning Vendor?
No. Sovereign Secure is a PCI QSA company, and external ASV scans are delivered through a PCI SSC Approved Scanning Vendor partner. We manage the process, interpret the results and guide remediation, so you get the ASV scan you need with the compliance expertise around it. See PCI ASV scanning for how it works.
How often are PCI scans required?
PCI DSS Requirement 11.3 requires internal and external vulnerability scans at least once every three months, and after any significant change. Only the quarterly external scans (11.3.2) must be performed by a PCI SSC Approved Scanning Vendor. Scans after a significant change (11.3.1.3 internal, 11.3.2.1 external) do not need an ASV: they can be run by qualified personnel, and for external scans the tester must be organisationally independent. We schedule scans to keep you on the quarterly cycle.
What happens if a scan fails?
A failing external scan must be remediated and rescanned until it passes. We help you understand the findings, prioritise the fixes and rescan, so you reach a passing result within the quarter.
Do you handle false positives?
Yes. We triage the raw output, remove false positives and prioritise what is left, so your team spends time on genuine issues rather than sifting a long automated list.
How long does a vulnerability scan take?
From a few minutes for a single host to several hours for a large network or an authenticated scan; our guide to how long a vulnerability scan takes explains what affects the time.
Why is vulnerability scanning important?
New vulnerabilities are published every day, and regular scans find them on your systems between penetration tests, before an attacker does; see why vulnerability scanning is important.
Is vulnerability scanning legal?
Yes, on systems you own or with the owner’s written authorisation; scanning systems without permission can be an offence under the Computer Misuse Act 1990, as our vulnerability scan guide explains.
What do you need from us for vulnerability scanning?
The systems and external addresses in scope, access for internal scanning, and a point of contact for remediation. For PCI ASV scanning we register your in-scope external addresses with the approved vendor. We confirm the detail during scoping.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- PCI ASV scansPCI scanning made simple: quarterly PCI ASV scans run through our PCI SSC Approved Scanning Vendor partner and managed by a QSA company. Get a fixed quote.
- External Penetration TestingExternal penetration testing of your internet-facing perimeter by a PCI QSA company: VPN, email, web and cloud, mapped to PCI DSS 11.4.3. Get a fixed quote.
- Internal Penetration TestingInternal penetration testing by a PCI QSA company: Active Directory attack paths, lateral movement and PCI 11.4.5 segmentation, remote or on-site. Get a quote.
- Penetration testing costPen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]